[Security Solution] Misleading prevalence tab

[MadameSheema]

After taking a look at the above screenshot, I initially thought that we had an issue because the document count was displayed as 0. After synced with @PhilippeOberti he explained me that:

alert count => documents with the highlighted field key/value pair that have event.kind === signal
document count => documents with the highlighted field  key/value pair that have event.kind !== signal

I believe the way we present the information might be a bit misleading since an alert is a document in our .alerts index, so for instance, in this specific case, I was expecting to see 1.

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[PhilippeOberti]

@MadameSheema these tooltip were added (and we checked with docs for the wording). Is that sufficient to close this ticket in your opinion?

https://github.com/elastic/kibana/assets/17276605/1e6921a0-7eab-41a6-a1b3-e852c2bfc63a

[MadameSheema]

Yes!